Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add gensecaihq/Wazuh-Autopilot --skill wazuh-cloud-containergit clone --depth 1 https://github.com/gensecaihq/Wazuh-AutopilotWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/gensecaihq/wazuh-autopilot/wazuh-cloud-container)<a href="https://agentmods.dev/skills/gensecaihq/wazuh-autopilot/wazuh-cloud-container"><img src="https://agentmods.dev/badge/skills/gensecaihq/wazuh-autopilot/wazuh-cloud-container/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/gensecaihq/wazuh-autopilot/wazuh-cloud-container"><img src="https://agentmods.dev/badge/skills/gensecaihq/wazuh-autopilot/wazuh-cloud-container.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00070 | $0.01590 |
| Opus 5.5 | $0.00028 | $0.00636 |
| Sonnet 5 | $0.00014 | $0.00318 |
| Haiku 4.5 | $0.00007 | $0.00159 |
Grade A, and why
wazuh-cloud-container scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 72 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Wazuh Cloud and Container
Cloud and SaaS logs reach Wazuh through integration modules on the manager (or a collector agent), so
the agent is usually the manager or collector — the real actor is in data.*. Always pivot on the
identity, source IP and resource from data, not on agent.name.
Integrations in the stock ruleset
| Source | Groups | Key rules (level) | Key fields |
|---|---|---|---|
| AWS CloudTrail | amazon, aws, aws_cloudtrail |
rule 80202 (level 3, API call), rule 80203 (level 4, API call with error), rule 80253 (level 3, console login success), rule 80254 (level 5, console login failed), rule 80255 (level 10, possible break-in attempt), rule 80252 (level 10, high number of deleted objects) | data.aws.eventName, eventSource, userIdentity.arn, sourceIPAddress, awsRegion, errorCode |
| AWS GuardDuty | aws_guardduty |
rules 80301, 80302, 80303 (levels 3, 6, 10 by finding severity); with remote IP: rules 80305, 80306, 80307 | data.aws.title, service.action.actionType, severity, resource |
| AWS VPC Flow / WAF / Config / Inspector / Macie / KMS / Security Hub | aws_vpcflow, aws_waf, aws_config, aws_inspector, aws_macie, aws_kms, aws_security_hub |
By group | Service-specific under data.aws.* |
| Azure | azure |
rule 87802 (level 3, "Azure: AD $(activityDisplayName)"), rule 87811 (level 3, Log Analytics operation) | data.activityDisplayName, operation, caller |
| Microsoft Graph (Defender/Entra alerts & incidents) | ms-graph |
rule 99503 (level 6, alert/incident not resolved and not a false positive) | alert title, severity, entities |
| GCP | gcp |
rule 65053 (level 3, firewall rule created), rule 65054 (level 3, firewall rule deleted), rule 65056 (level 3, logging bucket deleted), rule 65057 (level 3, logging sink deleted), rule 65070 (level 3, new service account created) | data.gcp.protoPayload.*, principal, resource |
| Office 365 | office365 |
rule 91556 (level 12, phishing/malware events from Exchange Online Protection / Defender), rule 91700 (level 14, malware detected in file), rule 91724 (level 10, suspicious download activity by user) | data.office365.UserId, Operation, ClientIP, Workload |
| GitHub | github |
rule 91152 (level 9, environment actions secret removed), rule 91197 (level 7, organization actions secret created); secret-scanning groups git_secret_scanning, git_repository_secret_scanning |
data.github.actor, action, repo, org |
| Docker (docker-listener) | docker |
rule 87907 (level 3, command launched in container), rule 87908 (level 5, shell session started in container), rule 87910 (level 3, file copied from host into container), rule 87902 (level 5, container destroyed) | data.docker.Actor.Attributes.name, image, Action |
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday First seen · 72 lines · 70 tokens per session scan A 9e628b8b07ab
wazuh-cloud-container is a skill published in the GitHub repository gensecaihq/Wazuh-Autopilot (57 stars, last pushed 2d ago), licensed MIT. It adds 70 tokens to every session and 1,590 once invoked, about $0.0003 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-25.
Other skills, from other repositories
agent-resource-allocator
Agent skill for resource-allocator - invoke with $agent-resource-allocator.
flow-nexus-swarm
Cloud-based AI swarm deployment and event-driven workflow automation with Flow Nexus platform.
agent-sandbox
Agent skill for sandbox - invoke with $agent-sandbox.
aiq-deploy
Use when asked to install, deploy, run, validate, troubleshoot, or stop NVIDIA AI-Q Blueprint infrastructure.
dynamo-recipe-runner
Select, validate, patch, and deploy existing NVIDIA Dynamo Kubernetes recipes. Use for model/backend/GPU/deployment-mode recipe bring-up; use router-starter for router-only mode work and troubleshoot for broken deployments.
ecs
AWS ECS container orchestration for running Docker containers. Use when deploying containerized applications, configuring task definitions, setting up services, managing clusters, or troubleshooting container issues.